What Is DDoS (Distributed Denial-of-Service)
What Is DDoS?
A distributed denial-of-service (DDoS) attack sends large volumes of traffic or requests from multiple systems to a server, network, or application, disrupting normal service. When the traffic exceeds the target’s processing capacity, servers and network devices can no longer process legitimate requests effectively, resulting in slow connections, failed requests, or page errors.
DDoS attacks are not limited to websites. Any internet-facing service can become a target, including mobile apps, online games, payment services, DNS (Domain Name System) servers, VPN services, and APIs. Attackers can slow down or interrupt these services without gaining direct access to internal systems.
DDoS attacks use several techniques Some send large numbers of packets, while others repeatedly send requests that are similar to normal web traffic, reducing the ability of servers, applications, or databases to process legitimate requests. Although the techniques differ, they all rely generating traffic or requests at the same time to disrupt normal service.
The use of distributed sources distinguishes DDoS attacks from denial-of-service (DoS) attacks, which typically originate from a single system or a small number of systems.
Differences Between DoS and DDoS Attacks
Both DoS and DDoS attacks disrupt normal service and prevent legitimate users from accessing it. They differ in where the attack traffic comes from, how much traffic is generated, how easily the source can be identified, and how difficult the attack is to mitigate.
| Category | DoS Attack | DDoS Attack |
|---|---|---|
| Attack source | One or a small number of attack systems | Many systems across multiple locations |
| Attack scale | Limited | Can generate much larger volumes of traffic |
| Source identification | Relatively easy | More difficult because traffic comes from distributed sources |
| Mitigation | Block traffic from the source and protect the target server | Apply traffic filtering, a WAF, a CDN, scrubbing, and other layered defenses |
| Distinguishing legitimate traffic | Generally easier because traffic comes from fewer sources | More difficult because malicious traffic is mixed with legitimate traffic |
These differences come from the number of systems used in the attack and how they are controlled. A DoS attack typically comes from a single system or a small number of systems. A DDoS attack, however, can use many compromised PCs, servers, routers, and IoT devices at once. Because the traffic comes from many devices and locations, it is harder to trace the attack to its sources and distinguish malicious traffic from legitimate traffic.
How DDoS Attacks Work
Many DDoS attacks are launched through botnets made up of compromised internet-connected devices. Attackers infect devices such as PCs, servers, routers, and IP cameras with malware, allowing them to be controlled remotely. Once compromised, these devices can be used to send traffic to the same target at the same time.
Once the botnet is ready, the attacker can make all of the compromised devices send traffic to the same target. This sudden increase can quickly consume network bandwidth, server resources, and the capacity of systems that handle incoming connections. When the system can no longer handle the incoming traffic, legitimate users may experience slow responses, failed transactions, or complete outages affecting websites, APIs, and payment services.
Types of DDoS Attacks
DDoS attacks generally fall into three categories. Volumetric attacks consume network bandwidth, protocol attacks interfere with connection handling, and application-layer attacks consume server and application resources. During attacks, adversaries may use several methods at once or change tactics as defenses are put in place.
Volumetric Attacks
A volumetric attack generates large volumes of traffic that use up the available bandwidth on the target’s internet connection. Even if the server itself is still working, legitimate users may be unable to reach the service because the attack has consumed the available bandwidth.
- UDP Flooding:
Sends large numbers of UDP packets to consume bandwidth and increase the number of packets the target must process. - ICMP Flooding:
Sends large volumes of ICMP packets, such as the echo requests used by ping, to consume bandwidth and force the target to process and respond to the traffic. - Reflection and Amplification Attack:
Uses third-party servers to send traffic to the victim. The attacker places the victim’s IP address in the requests, causing the servers to send their replies to the victim instead. When the replies are larger than the original requests, the amount of traffic reaching the target increases.
Protocol Attacks
Protocol attacks target the way TCP/IP connections are established and maintained. Instead of using high traffic volumes, they create large numbers of incomplete or abnormal connections that use up the capacity of servers and network security devices. This can prevent firewalls, intrusion prevention systems, load balancers, and servers from handling legitimate connections properly.
- SYN Flooding:
Repeatedly starts TCP connections without completing the handshake. The unfinished connections build up until the server can no longer accept new ones. - ACK Flooding:
Sends large numbers of ACK packets, forcing firewalls and servers to inspect the traffic and verify whether each packet belongs to an existing connection. - TCP Flag Flooding:
Sends packets with unusual or invalid TCP flag combinations, requiring network devices to inspect and process traffic that does not follow normal connection patterns. - Fragmentation Flooding:
Sends large numbers of fragmented IP packets, forcing the target system to reassemble them and using up memory and processing resources.
Application-Layer Attacks
Application-layer attacks exhaust resources that establish secure connections and process web requests. They do not require as much traffic as volumetric attacks, but repeated connection attempts or web requests can still use up CPU, memory, connection capacity, and application or database resources.
- SSL/TLS Flooding:
Repeatedly starts SSL/TLS handshakes, forcing the server to perform encryption related calculations and maintain large numbers of connections. - HTTP Flooding:
Sends large numbers of GET, POST, or other HTTP requests, causing the web server, application, and database to spend resources processing them. - HTTPS Flooding:
Sends large numbers of encrypted HTTP requests, requiring servers and security devices to process both the encrypted traffic and the web requests. - Slow HTTP Attack:
Sends HTTP headers or body data at a slow rate, keeping connections open until the web server reaches its concurrent connection limit and can no longer accept additional connections.
Multi-Vector DDoS Attacks
A multi-vector DDoS attack uses several attack methods at once or switches methods in response to mitigation measures.
When several attack methods are used together, they can affect network bandwidth, connection handling, and application processing at the same time. This makes mitigation more difficult because blocking one type of traffic does not stop the others.
Attackers may switch traffic types to bypass DDoS mitigation. If network controls block a high-volume flood, they can shift to HTTP requests targeting the application. If application-layer controls block those requests, they can return to UDP or TCP floods and continue the attack.
A multi-vector attack is difficult to identify through a single metric or device log. Defenders need to monitor bandwidth usage, packet rates, incomplete connections, HTTP request volumes, and server resource usage together to determine which types of attacks are being used and how the attack changes over time.
Common Indicators of a DDoS Attack
A DDoS attack cannot be identified from one indicator alone. Detection requires reviewing traffic patterns, network performance, connection activity, and service availability together.
- The following signs can be indicators of a DDoS attack:
- A sudden increase in traffic
- A concentration of requests from a particular IP address or IP range
- A sharp change in the mix of TCP, UDP, or ICMP traffic
- Unusual changes in packet size or request frequency
- A surge in repeated requests to a specific webpage, URL, or API endpoint
- An increase in incomplete connection attempts
- Slow responses or outages affecting websites and online services
A sudden increase in traffic does not always mean an attack. Promotions, product launches, media coverage, and user growth can produce similar spikes. To distinguish legitimate demand from malicious traffic, defenders should compare where the traffic comes from, how often requests are sent, which protocols are used, when the change began, and whether service performance has declined. Continuous monitoring helps detect attacks early and respond before service disruption.
DDoS Mitigation Strategies
To minimize service disruption, organizations need to filter malicious traffic before it reaches critical systems. Effective mitigation also requires controlling excessive requests and distributing traffic across available infrastructure so that legitimate users can continue accessing the service.
Traffic Filtering
Traffic filtering blocks traffic that shows signs of an attack, such as repeated connection attempts or requests. This reduces the amount of malicious traffic reaching servers and network devices, leaving resources available for legitimate requests. As botnets send traffic from several IP addresses, filtering should not rely on IP addresses alone. It should also consider request frequency, incomplete connections, and unusual traffic patterns.
Case Study
Building a Service-Specific DDoS Mitigation Architecture with AhnLab DPX
Rate Limiting
Rate limiting controls how many requests an IP address, session, user account, or API key can send within a set period. This helps prevent a large number of requests from reaching the same function at once and reduces the burden on web servers, applications, and databases.
Limits that are too strict can also block legitimate users. Each function should therefore have its own limit based on normal request volumes and the amount of server resources it uses. Login, search, and file download functions, for example, should not all be subject to the same limit.
Web Application Firewall (WAF)
A web application firewall (WAF) examines incoming HTTP and HTTPS requests and blocks requests that show signs of an attack. It can detect attacks targeting login, search, file download, and other functions by checking requested URLs, request methods, headers, request frequency, and session activity.
A WAF helps stop application-layer attacks before they reach the web server. However, it does not protect against attacks that consume network bandwidth with very large volumes of traffic. These attacks also require network-level protection.
CDN and Anycast-Based Traffic Distribution
A content delivery network (CDN) serves content and handles requests through servers in different locations. Anycast uses the same IP address across multiple network locations and directs traffic to the closest or most suitable one. This spreads incoming traffic across multiple locations instead of sending it all to a single server or data center. Because traffic distribution does not block malicious requests by itself, it should be combined with traffic filtering, WAF rules, and rate limiting.
Cloud Scrubbing
Cloud scrubbing redirects incoming traffic. The service blocks malicious traffic and sends legitimate traffic to the protected systems. Because the traffic is filtered outside the organization’s network, the service can handle attacks that exceed the capacity of the organization’s internet connection. Organizations should establish traffic diversion procedures with their internet service provider or DDoS mitigation provider in advance so traffic can be redirected quickly when an attack is detected.
DDoS attacks differ in scale, traffic patterns, and targets. Some consume network bandwidth, while others exhaust server or application resources, and attackers can use several methods together. Effective mitigation combines network and application-layer controls to block malicious traffic without disrupting legitimate access. When these measures are used together, organizations can reduce service disruption and maintain access for legitimate users.
Case Study
A Complete Guide for Telecom DDoS Mitigation
FAQ
Do DDoS attacks always generate massive traffic volumes?
No. Some DDoS attacks cause a sharp increase in traffic, while others do not. UDP floods and DNS amplification attacks consume network bandwidth by sending large amounts of traffic. Application-layer attacks send repeated HTTP requests that can look like normal web activity. In these cases, overall bandwidth usage may change little even though a specific page or function slows down.
Traffic volume alone is therefore not enough to identify a DDoS attack. Defenders should also look for repeated requests to a specific URL, increases in incomplete connections, and response times that differ from normal levels.
Why are DDoS attacks more difficult to mitigate than DoS attacks?
A DoS attack usually comes from a single system or a small number of sources. A DDoS attack, by contrast, uses many compromised PCs, servers, routers, and IoT devices to send requests at the same time. Blocking some of the attacking IP addresses may have little effect because traffic continues from the remaining devices. Blocking entire IP ranges can also disrupt legitimate users who share the same networks.
Do mitigation methods differ by attack type?
Yes. Different types of DDoS attacks affect different parts of a service, so each one requires a different response.
Volumetric attacks consume internet bandwidth by sending very large amounts of traffic. This traffic should be distributed or filtered before it reaches the organization using a CDN, an Anycast network, or a cloud scrubbing service.
SYN floods create large numbers of incomplete connections, which can prevent servers, firewalls, and other network devices from accepting new connections. Defenders should monitor incomplete connection attempts and block or limit traffic that repeatedly creates them.
HTTP floods repeatedly send requests to specific pages or functions until the application or database can no longer process them effectively. Defenders should look for unusual request patterns and apply WAF rules or rate limits to the affected URLs and functions.
Can a CDN and WAF stop every DDoS attack?
No. A CDN and a WAF protect different parts of a service from different types of DDoS traffic.
A CDN distributes incoming traffic across multiple locations, reducing the amount of traffic sent directly to the origin server. A WAF examines HTTP requests and blocks repeated or unusual requests targeting specific URLs or application functions.
UDP and ICMP floods can consume all available network bandwidth before the traffic reaches the CDN or WAF. These attacks require network-level filtering or cloud scrubbing. Organizations should combine these measures according to the services they need to protect and the types of attacks they are most likely to face.
Our DDoS Mitigation Solution
AhnLab DPX is a DDoS mitigation solution that provides full-scale network packet inspection and multiple detection techniques to mitigate attacks ranging from low to high-volume. It uses threshold-based rules and TCP/HTTP authentication to distinguish traffic generated by legitimate users from bots and block malicious traffic in real time. It also supports integration with cloud scrubbing centers to handle excess traffic and help maintain business continuity during large-scale attacks.
